Security
فارسی
All products

OpenShift Service Mesh 2/openshift-service-mesh/kiali-ossmc-rhel8

Red Hat · Package
48 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH lodash-amdlodash-es npmRed Hat Medium Fix reported
Cross-site Scripting (XSS) in serialize-javascriptCVE-2024-11831 · GHSA-76P7-773F-R4Q5 serialize-javascript.NET 6.0 on Red Hat Enterprise Linux/rh-dotnet60-dotnet npmRed Hat Medium Fix reported
Immutable.js `List` 32-bit trie overflow → unrecoverable DoSCVE-2026-59879 · GHSA-V56Q-MH7H-F735 immutableLogging Subsystem for Red Hat OpenShift/openshift-logging/logging-view-plugin-rhel9 npmRed Hat High Fix reported
shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)CVE-2026-13311 · GHSA-395F-4HP3-45GV shell-quoteCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat High Fix reported
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsCVE-2026-13149 · GHSA-3JXR-9VMJ-R5CP brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat High Fix reported
Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean CoercionCVE-2026-42042 · GHSA-XX6V-RP6X-Q39C axiosCryostat 4/axios npmRed Hat Medium Fix reported
brace-expansion: Large numeric range defeats documented `max` DoS protectionCVE-2026-45149 · GHSA-JXXR-4GWJ-5JF2 brace-expansionConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Axios: no_proxy bypass via IP alias allows SSRFCVE-2026-42038 · GHSA-M7PR-HJQH-92CM axiosCryostat 4/axios npmRed Hat Medium Fix reported
axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsCVE-2026-44490 · GHSA-898C-Q2CR-XWHG axiosCryostat 4/axios npmRed Hat Medium Fix reported
DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING FallbackCVE-2026-41238 · GHSA-V9JR-RG53-9PGP dompurifyCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputCVE-2026-41305 · GHSA-QX2V-QP2M-JG93 postcssCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
brace-expansion: Zero-step sequence causes process hang and memory exhaustionCVE-2026-33750 · GHSA-F886-M6HF-6M8V brace-expansionCryostat 4/brace-expansion npmRed Hat Medium Fix reported
js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 npmRed Hat Medium Fix reported
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URLCVE-2025-27152 · GHSA-JR5F-V2JV-69X6 axiosCryostat 3/io.cryostat-cryostat3 npmRed Hat High Fix reported
React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-40181 · GHSA-2J2X-HQR9-3H42 @remix-run/routerreact-router npmRed Hat Medium Fix reported
qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is setCVE-2026-8723 · GHSA-Q8MJ-M7CP-5Q26 qsConfidential Compute Attestation/openshift-sandboxed-containers/osc-pccs npmRed Hat Medium Fix reported
Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijackingCVE-2026-42264 · GHSA-Q8QP-CVCW-X6JJ axiosOpenShift Pipelines/openshift-pipelines/pipelines-hub-ui-rhel8 npmRed Hat High Fix reported
JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliasesCVE-2026-53550 · GHSA-H67P-54HQ-RP68 js-yamlCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Medium Fix reported
Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParamsCVE-2026-42040 · GHSA-XHJH-PMCV-23JW axiosCryostat 4/axios npmRed Hat Low Fix reported
postcss-selector-parser allows denial of service through uncontrolled AST recursionCVE-2026-9358 · GHSA-W9M9-85WC-3X92 postcss-selector-parserCryostat 4/cryostat-openshift-console-plugin-npm npmRed Hat Low Fix reported